Privacy Policy

Last updated: 16 May 2026

Manipulator is a Chrome extension that scores tweets on x.com / twitter.com for engagement-bait patterns. The extension runs entirely in your browser. No data leaves your device apart from network requests that x.com itself would already make, plus a one-time ML-model download.

What stays local (never sent anywhere)

In chrome.storage.local

• Per-handle scoring history — running count and average score for each X handle you've scrolled past. Built up purely from on-device computation. Used to recognize accounts that have posted many manipulative tweets and adjust future scores accordingly.
• "About this account" cache (7-day expiry) — the public profile data X shows on the /about sub-page: country, date joined, verification, posting client. Cached per handle so that profile data doesn't need to be re-fetched on every page reload.

In sessionStorage

• A rate-limit backoff timestamp, so the extension doesn't repeatedly hammer X's API if it returns a 429 response.

In browser IndexedDB (managed by Hugging Face Transformers.js)

• The on-device ML model weights (~70 MB) — downloaded once on first use, cached afterward.

What is NEVER collected or transmitted

• Tweet text content
• Tweet authors' handles or display names
• Profile data (country, dates, verification status, posting client)
• Tweet URLs or IDs
• Your own X account, email, name, IP address, or any personally identifiable information
• Your scoring history or which tweets you have viewed

These categories are read in your browser solely to compute the score badge, then discarded. They are not transmitted to any remote service.

Network requests Manipulator makes

The extension only contacts the following hosts:

• x.com / twitter.com — same-origin GraphQL request to the AboutAccountQuery endpoint to fetch the public "About this account" profile for tweet authors. Uses your existing X session cookies, identical to what x.com itself does when you open a profile page. No data is sent about you to X beyond your normal browsing session.
• huggingface.co, *.huggingface.co, cdn-lfs.huggingface.co — used once per install to download the ML model weights and tokenizer (data files only — no executable code). Cached in your browser's IndexedDB thereafter.

The extension makes no other network requests. There is no developer-controlled server, no analytics endpoint, no telemetry, no advertising or tracking pixels, and no third-party SDK.

No analytics, no tracking

Manipulator does not include any analytics or telemetry. There is no opt-in tier that enables data collection. The developer has no way to learn anything about your use of the extension — including how often you use it, what tweets you see, or whether you have it installed.

Permissions

• storage — to persist the local scoring history and About-data cache described above.
• offscreen — to host a hidden HTML document where the on-device ML model runs. Required because Manifest V3 service workers cannot run the inference library.
• Host permissions on x.com, twitter.com — to inject the score badge into the timeline and to call X's "About this account" API using your existing session.
• Host permissions on huggingface.co (and subdomains) — to download the ML model weights on first install.

Children

Manipulator is not directed at children under 13 and does not knowingly collect any data from them. (In fact, it doesn't knowingly collect data from anyone.)

Open source

You can audit every claim in this policy by reading the extension's source code. The codebase is small enough to inspect in an afternoon — every fetch, every chrome.storage call, every DOM access is in the open.

Changes to this policy

If this policy changes, the updated version replaces this page and is bundled in the next extension release. Material changes (e.g. adding any new network destination) would be called out in the extension's Chrome Web Store listing change notes.

Contact

For questions, open an issue on the extension's source repository, or contact the developer via the email address listed on the Chrome Web Store listing.